Critical Security Update for Go Toolset: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:2706: Important: golang security update. Affects go-toolset versions < 1.25.7-1.el10_1.alma.1. Fixed in 1.25.7-1.el10_1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go Toolset is a collection of tools and libraries that facilitate the development of applications using the Go programming language. It includes the Go compiler, standard libraries, and additional tools to enhance the development experience. The Go Toolset is widely used for building scalable and efficient applications, making it a critical component in many software ecosystems. However, recent vulnerabilities have been identified that could potentially compromise the security and performance of applications built with this toolset.
Vulnerability Detail
The vulnerabilities identified in the Go Toolset include excessive CPU consumption during archive index building (CVE-2025-61728), memory exhaustion in query parameter parsing (CVE-2025-61726), potential code smuggling via documentation comments (CVE-2025-61732), and unexpected session resumption in TLS (CVE-2025-68121). These vulnerabilities can lead to performance degradation, application crashes, and security breaches, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
1.25.7-1.el10_1.alma.1
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for query parameters to mitigate memory exhaustion issues. Additionally, avoiding the use of certain features in cmd/cgo until the update is applied can help reduce the risk of code smuggling.
Conclusion
The recent vulnerabilities identified in the Go Toolset pose significant risks to applications built using this programming language. Users are strongly encouraged to update to the latest patched version to ensure the security and performance of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for go-toolset →
FAQ
The main vulnerabilities include excessive CPU consumption, memory exhaustion, potential code smuggling, and unexpected session resumption in TLS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
It is recommended to update to the patched version 1.25.7-1.el10_1.alma.1 as soon as possible to mitigate the risks associated with these vulnerabilities.
Yes, limiting input sizes for query parameters and avoiding certain cmd/cgo features can serve as temporary workarounds until the update is applied.
More information can be found on the CVE pages linked in the advisory, which provide detailed descriptions and impact assessments.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
